Activity variable contracts: the corpus declares what each activity reads and writes

cicd-pipeline-security-audit/activities/01-scope-setup.yaml

@@ -1,7 +1,11 @@
 id: scope-setup
-version: 1.2.0
+version: 1.3.0
 name: Scope Setup
 description: Set up the audit scope and planning folder.
+variables:
+  reads:
+    - planning_folder_path
+    - target_submodules
 techniques:
   - execute-cicd-audit
 required: true

cicd-pipeline-security-audit/activities/02-reconnaissance.yaml

@@ -1,7 +1,16 @@
 id: reconnaissance
-version: 1.2.0
+version: 1.4.0
 name: Reconnaissance
 description: Classify discovered workflows and assign scanner agents.
+variables:
+  reads:
+    - planning_folder_path
+    - target_submodules
+  writes:
+    - name: scanners_assigned
+      type: number
+      description: Count of per-submodule scanner agents assigned during reconnaissance
+      defaultValue: 0
 techniques:
   - execute-cicd-audit
 required: true
@@ -31,9 +40,6 @@ steps:
     actions:
       - action: log
         message: Reconnaissance complete — workflows classified and scanner agents assigned
-      - action: set
-        target: reconnaissance_complete
-        value: true
 transitions:
   - to: primary-scan
     isDefault: true

cicd-pipeline-security-audit/activities/03-primary-scan.yaml

@@ -1,7 +1,13 @@
 id: primary-scan
-version: 1.3.0
+version: 1.5.0
 name: Primary Scan
 description: Run per-submodule scanner agents and merge their findings.
+variables:
+  reads:
+    - merge_complete
+    - planning_folder_path
+    - scanners_assigned
+    - verification_complete
 techniques:
   - scatter-gather
   - execute-cicd-audit
@@ -62,9 +68,6 @@ steps:
     actions:
       - action: log
         message: Primary scan complete — all findings merged and reconciled
-      - action: set
-        target: primary_scan_complete
-        value: true
 transitions:
   - to: report-generation
     isDefault: true

cicd-pipeline-security-audit/activities/04-report-generation.yaml

@@ -1,7 +1,10 @@
 id: report-generation
-version: 1.4.0
+version: 1.6.0
 name: Report Generation
 description: Produce the final CI/CD security audit report.
+variables:
+  reads:
+    - planning_folder_path
 techniques:
   - execute-cicd-audit
 required: true
@@ -37,9 +40,6 @@ steps:
     actions:
       - action: log
         message: Report generation complete — CI/CD security audit report finalized
-      - action: set
-        target: report_complete
-        value: true
 transitions: []
 outcome:
   - Readers can triage findings by consistent, defensible severity rather than gut feel, with the report backed by a passed coverage gate so they can trust nothing in scope was missed

cicd-pipeline-security-audit/activities/05-sub-workflow-scan.yaml

@@ -1,7 +1,10 @@
 id: sub-workflow-scan
-version: 1.2.0
+version: 1.3.0
 name: Per-Submodule Workflow Scan
 description: Scan the assigned submodule's workflow files for the seven detection patterns.
+variables:
+  reads:
+    - planning_folder_path
 techniques:
   - execute-sub-agent
 required: false

cicd-pipeline-security-audit/activities/06-sub-verification.yaml

@@ -1,7 +1,15 @@
 id: sub-verification
-version: 1.2.0
+version: 1.3.0
 name: Scan Verification
 description: Verify scan completeness across all scanner outputs.
+variables:
+  reads:
+    - planning_folder_path
+  writes:
+    - name: verification_complete
+      type: boolean
+      description: Phase 3 verification gate.
+      defaultValue: false
 techniques:
   - execute-sub-agent
 required: false

cicd-pipeline-security-audit/activities/07-sub-merge.yaml

@@ -1,7 +1,15 @@
 id: sub-merge
-version: 1.2.0
+version: 1.3.0
 name: Finding Merge
 description: Merge scanner outputs into a unified finding set.
+variables:
+  reads:
+    - planning_folder_path
+  writes:
+    - name: merge_complete
+      type: boolean
+      description: Phase 3 merge gate.
+      defaultValue: false
 techniques:
   - execute-sub-agent
 required: false

cicd-pipeline-security-audit/workflow.yaml

@@ -1,6 +1,6 @@
 $schema: ../../schemas/workflow.schema.json
 id: cicd-pipeline-security-audit
-version: 1.2.0
+version: 1.3.0
 title: CI/CD Pipeline Security Audit Workflow
 description: Fully automated multi-phase AI security audit for GitHub Actions CI/CD pipelines. Detects source-to-sink injection vulnerabilities exploited by autonomous attack agents (hackerbot-claw campaign, Feb 2026).
 author: m2ux
@@ -38,52 +38,4 @@ variables:
   - name: planning_folder_path
     type: string
     description: "Path to planning folder: .engineering/artifacts/planning/YYYY-MM-DD-cicd-security-audit"
-  - name: workflow_file_count
-    type: number
-    description: Total number of workflow files discovered across all target submodules
-    defaultValue: 0
-  - name: submodule_count
-    type: number
-    description: Number of submodules in scope
-    defaultValue: 0
-  - name: scanners_assigned
-    type: number
-    description: Count of per-submodule scanner agents assigned during reconnaissance
-    defaultValue: 0
-  - name: scanners_dispatched
-    type: number
-    description: Count of scanner agents actually dispatched and returned
-    defaultValue: 0
-  - name: reconnaissance_complete
-    type: boolean
-    description: Phase 2 gate — reconnaissance finished
-    defaultValue: false
-  - name: primary_scan_complete
-    type: boolean
-    description: Phase 3 gate — all scanners returned
-    defaultValue: false
-  - name: verification_complete
-    type: boolean
-    description: Phase 3 verification gate.
-    defaultValue: false
-  - name: merge_complete
-    type: boolean
-    description: Phase 3 merge gate.
-    defaultValue: false
-  - name: report_complete
-    type: boolean
-    description: Phase 4 gate — report generation finished
-    defaultValue: false
-  - name: total_findings
-    type: number
-    description: Total number of confirmed findings after merge
-    defaultValue: 0
-  - name: critical_findings
-    type: number
-    description: Number of Critical-severity findings
-    defaultValue: 0
-  - name: high_findings
-    type: number
-    description: Number of High-severity findings
-    defaultValue: 0
 initialActivity: scope-setup

codebase-wiki/activities/01-confirm-scope.yaml

@@ -1,7 +1,29 @@
 id: confirm-scope
-version: 1.0.0
+version: 1.1.0
 name: Confirm Scope
 description: "Resolve the wiki target and pin the citation baseline, then capture and confirm what this build pass will ingest."
+variables:
+  reads:
+    - raw_baseline_commit
+    - wiki_path
+  writes:
+    - name: ingest_plan
+      type: array
+      description: Ordered list of areas to ingest, derived from ingest_scope.
+    - name: ingest_scope
+      type: string
+      description: Free-form description of what this build pass should cover — the source areas, and any task-derived knowledge, to ingest into the wiki.
+      defaultValue: ""
+    - name: ingest_scope_confirmed
+      type: boolean
+      description: Whether the user confirmed the ingest scope and plan.
+      defaultValue: false
+    - name: raw_baseline_commit
+      type: string
+      description: The pinned source commit every citation is relative to. The raw baseline is the source tree at this commit, referenced in place — there is no physical copy.
+    - name: wiki_path
+      type: string
+      description: Root of the wiki tree — holds index.md, log.md, overview.md, and the typed-page subfolders.
 required: true
 steps:
   - kind: technique

codebase-wiki/activities/02-build-wiki.yaml

@@ -1,7 +1,18 @@
 id: build-wiki
-version: 1.0.0
+version: 1.1.0
 name: Build Wiki
 description: Ingest each area in the confirmed plan into typed, cited wiki pages, maintaining the index and log on every mutation.
+variables:
+  reads:
+    - ingest_plan
+    - ingest_scope_confirmed
+    - raw_baseline_commit
+    - wiki_path
+  writes:
+    - name: target_area
+      type: string
+      description: A single source area — module, package, subsystem, or file set — named within the ingest scope, the unit an ingest pass operates over.
+      defaultValue: ""
 required: true
 steps:
   - kind: action

codebase-wiki/activities/03-lint-wiki.yaml

@@ -1,7 +1,20 @@
 id: lint-wiki
-version: 1.2.0
+version: 1.3.0
 name: Lint Wiki
 description: Bring the built pages into line with their guides, run the wiki integrity checks over the result, and decide whether findings warrant a re-ingest pass.
+variables:
+  reads:
+    - raw_baseline_commit
+    - wiki_path
+  writes:
+    - name: lint_findings_count
+      type: number
+      description: Number of lint findings from the lint pass.
+      defaultValue: 0
+    - name: needs_reingest
+      type: boolean
+      description: Whether the user opted to fix lint findings by re-ingesting.
+      defaultValue: false
 required: true
 steps:
   - kind: technique

codebase-wiki/activities/04-publish.yaml

@@ -1,7 +1,18 @@
 id: publish
-version: 1.0.0
+version: 1.2.0
 name: Publish
 description: Finalize the index, log, and overview, then record the wiki as published. Local-only — no branch, commit, or pull-request operations.
+variables:
+  reads:
+    - raw_baseline_commit
+    - wiki_path
+  writes:
+    - name: published_pages
+      type: array
+      description: The pages the publish refresh touches — the overview.md finalized at publish.
+    - name: wiki_overview
+      type: string
+      description: The composed overview.md completion summary — areas covered, page counts by type, the citation baseline commit, and any accepted lint findings.
 required: true
 steps:
   - kind: action
@@ -32,9 +43,6 @@ steps:
   - kind: action
     id: record-published
     actions:
-      - action: set
-        target: wiki_published
-        value: true
       - action: message
         message: "Wiki published locally at {wiki_path} — index.md, log.md, and overview.md are finalized. No branch, commit, or PR was created."
 outcome:

codebase-wiki/workflow.yaml

@@ -1,6 +1,6 @@
 $schema: ../../schemas/workflow.schema.json
 id: codebase-wiki
-version: 1.0.0
+version: 1.1.0
 title: Codebase Wiki Workflow
 description: Build and maintain a durable, citation-backed, navigable LLM knowledge base over a codebase, in the Karpathy LLM-wiki format adapted for code. Its operations are reusable techniques other workflows bind via codebase-wiki/<op> to create, augment, query, or update the wiki.
 author: m2ux
@@ -23,37 +23,4 @@ variables:
   - name: raw_baseline_commit
     type: string
     description: The pinned source commit every citation is relative to. The raw baseline is the source tree at this commit, referenced in place — there is no physical copy.
-  - name: ingest_scope
-    type: string
-    description: Free-form description of what this build pass should cover — the source areas, and any task-derived knowledge, to ingest into the wiki.
-    defaultValue: ""
-  - name: target_area
-    type: string
-    description: A single source area — module, package, subsystem, or file set — named within the ingest scope, the unit an ingest pass operates over.
-    defaultValue: ""
-  - name: ingest_plan
-    type: array
-    description: Ordered list of areas to ingest, derived from ingest_scope.
-  - name: ingest_scope_confirmed
-    type: boolean
-    description: Whether the user confirmed the ingest scope and plan.
-    defaultValue: false
-  - name: lint_findings_count
-    type: number
-    description: Number of lint findings from the lint pass.
-    defaultValue: 0
-  - name: needs_reingest
-    type: boolean
-    description: Whether the user opted to fix lint findings by re-ingesting.
-    defaultValue: false
-  - name: published_pages
-    type: array
-    description: The pages the publish refresh touches — the overview.md finalized at publish.
-  - name: wiki_overview
-    type: string
-    description: The composed overview.md completion summary — areas covered, page counts by type, the citation baseline commit, and any accepted lint findings.
-  - name: wiki_published
-    type: boolean
-    description: Whether the wiki has been finalized — index, log, and overview refreshed and the completion summary written.
-    defaultValue: false
 initialActivity: confirm-scope